CVE-2020-16846

Sažetak

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

Reference

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
https://github.com/saltstack/salt/releases
https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
https://security.gentoo.org/glsa/202011-13
https://www.debian.org/security/2021/dsa-4837
https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
https://www.zerodayinitiative.com/advisories/ZDI-20-1383/
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html
http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html
https://github.com/saltstack/salt/releases
https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html
https://lists.debian.org/debian-lts-announce/2022/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/
https://security.gentoo.org/glsa/202011-13
https://www.debian.org/security/2021/dsa-4837
https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
https://www.zerodayinitiative.com/advisories/ZDI-20-1379/
https://www.zerodayinitiative.com/advisories/ZDI-20-1380/
https://www.zerodayinitiative.com/advisories/ZDI-20-1381/
https://www.zerodayinitiative.com/advisories/ZDI-20-1382/
https://www.zerodayinitiative.com/advisories/ZDI-20-1383/

CVSS

Base:	7.5
Impact:	6.4
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	PARTIAL	PARTIAL

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:P/A:P

Zadnje važnije ažuriranje

14-03-2025 - 17:28

Objavljeno

06-11-2020 - 08:15